Knowing your enemy: understanding and detecting malicious web advertising

  • Authors:

  • Zhou Li;Kehuan Zhang;Yinglian Xie;Fang Yu;XiaoFeng Wang

  • Affiliations:

  • Indiana University at Bloomington, Bloomington, IN, USA;Indiana University at Bloomington, Bloomington, IN, USA;MSR Silicon Valley, Mountain View, CA, USA;MSR Silicon Valley, Mountain View, CA, USA;Indiana University at Bloomington, Bloomington, IN, USA

  • Venue:
  • Proceedings of the 2012 ACM conference on Computer and communications security
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

With the Internet becoming the dominant channel for marketing and promotion, online advertisements are also increasingly used for illegal purposes such as propagating malware, scamming, click frauds, etc. To understand the gravity of these malicious advertising activities, which we call malvertising, we perform a large-scale study through analyzing ad-related Web traces crawled over a three-month period. Our study reveals the rampancy of malvertising: hundreds of top ranking Web sites fell victims and leading ad networks such as DoubleClick were infiltrated. To mitigate this threat, we identify prominent features from malicious advertising nodes and their related content delivery paths, and leverage them to build a new detection system called MadTracer. MadTracer automatically generates detection rules and utilizes them to inspect advertisement delivery processes and detect malvertising activities. Our evaluation shows that MadTracer was capable of capturing a large number of malvertising cases, 15 times as many as Google Safe Browsing and Microsoft Forefront did together, at a low false detection rate. It also detected new attacks, including a type of click-fraud attack that has never been reported before.